TOOL GUIDE · HTML TEXT ESCAPING
What gets escaped
The operation converts ampersand, less-than, greater-than, double-quote, and apostrophe characters to entity forms. Escaping ampersand first is important: otherwise, the ampersand introduced by a newly written entity could itself be escaped. The result is a text representation that an HTML parser can display as characters in the appropriate text context.
Escaping is context-sensitive. Text inserted into an HTML text node, a quoted attribute, a JavaScript string, a CSS value, and a URL do not all share one universal escaping rule. Use the output only for the context it is designed for and rely on safe templating or DOM APIs where possible.
Escaping is not sanitizing
This tool does not inspect a document structure, allowlist safe tags, or remove dangerous attributes and URLs. It is not an HTML sanitizer and does not make arbitrary markup safe to render. If your application must accept user-authored rich HTML, use a maintained sanitizer configured for the exact allowed policy and keep it updated.
For display as literal text, rendering via a text API is often safer than inserting HTML. If you need to restore entities to characters, use HTML Unescape only when the source is trusted and the purpose is clear.
Example
The text <tag> & value is represented with entities so the special characters can be displayed literally. Before using output in code, determine which parser will consume it and apply that parser’s documented rules.
The conversion happens locally in your browser. Never rely on character escaping alone as a security boundary.